Does (Zimbra using) Postfix have an option to whitelist IPs or domains for IMAP logins for a specific mailbox only?
This is what we would like to achieve:
- all IPs can open an IMAP connection on port 993 with valid firstname.lastname@example.org credentials
- all IPs can open an IMAP connection on port 993 with valid email@example.com credentials
- only 18.104.22.168, 22.214.171.124/24 and foo.example.com can open an IMAP connection on port 993 with valid firstname.lastname@example.org credentials
Preferably when someone from 126.96.36.199 tries to open an IMAP session with email@example.com credentials the same error should be returned as for an unsuccessful login attempt due to wrong password or non existant recipient address, with the same timeout (e.g. 10 seconds).
Background: our mailserver (Zimbra using Postfix) is under intermittent attacks on specific mailboxes resulting in those mailboxes getting locked out due to the number of failed IMAP login attempts per hour for that mailbox. The login attempts are coming as a slow trickle from unique IPs (2-3 login attempts per minute on the same mailbox) so banning IPs is not a solution. Increasing the number of failed attempts per hour limit only allows the attack to proceed and opens the door for larger concurrent attacks.
Firewalling the IMAP port is not an option since we would like to keep access open from outside the VPN/corporate network except for those mailboxes that are under a current/persistent attack. Inspecting the traffic there is also not possible since it's encrypted.
So we are looking for something like postscreen_access_list but for specific recipients only as we would like to limit access only to those mailboxes that are under attack.